Hacker News Reader

Comment by WatchDog | Hacker News Reader

I'm interested in how this compares to AWS nitro enclaves, which they mention briefly.

The main difference seems to be verifiability down to the firmware level.

Nitro enclaves does not provide measurements of the firmware[0], or hypervisor, furthermore they state that the hypervisor code can be updated transparently at any time[1].

Apple is going to provide images of the secure enclave processor operating system(sepOS), as well as the bootloader.

It also sounds like they will provide the source code for these components too, although the blog post isn't clear on that.

[0]: https://docs.aws.amazon.com/enclaves/latest/user/set-up-atte....

[1]: https://docs.aws.amazon.com/pdfs/whitepapers/latest/security...

View on HN

Nitro does measure firmware. If any firmware is unexpected, server will essentially stop being connected to the EC2 substrate network and/or server wiped clean automatically. People will be paged automatically, security will likely be pulled in, etc.

There is no reason to measure hypervisor firmware as it’s not firmware in the case of EC2. The BIOS/UEFI firmware on the mobo is overwritten if it’s tampered with. Hypervisor code (always signed, like all code) is streamed via a verifiably secure system on the server (Nitro cards, which make use of measured boot and/or secure boot).

No idea what the customer facing term “Nitro enclaves” means, but EC2 engineers are literally mobilized like an army with pages when any security risk (even minor ones) is determined. Basic stuff like this is covered. We even go as far as guaranteeing core dumps don’t contain any real customer data, even encrypted

I'm glad to hear about those internal processes, but I guess the key point of difference is that in apple's case, the measurements of the firmware are provided and verifiable externally.

Although in the end, I'm not sure how much of a difference it makes, as ultimately, even with measurements of the whole stack, the platform provider if compelled to do so, can still push out a malicious firmware that fakes it's measurements.

Aws had to do it this way because of their custom silicon, Intel, ARM and AMD do provide firmware/hypervisor level attestation

Reply on news.ycombinator.com